SP session time-out period, IDP session time-out period, <NotBefore> and <NotOnOrAfter>

[Adam Dong]

Peter,

Thanks a lot for the reply.

About SessionNotOnOrAfter as part of the AuthnStatement, is that commonly put in the Assertions by IDPs ?

Or is it fairly to say: other than browser-triggered SLO, SP and IDP sessions time out on their own configuration/policy separately, usually there is no synchronization between the two ?

Thanks,
Adam Dong
Vidder, Inc.



-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Tuesday, December 02, 2014 5:08 PM
To: users at shibboleth.net
Subject: Re: SP session time-out period, IDP session time-out period, <NotBefore> and <NotOnOrAfter>

* Adam Dong <adamdong at vidder.com> [2014-12-03 01:45]:
> How is the SP local session time-out period decided ?

When the configured (or defaulted) number of seconds have passed without the SP having seen a request from the browser.

> It has nothing to do with the <NotBefore> and <NotOnOrAfter> in the 
> <Assertion>’s <SubjectConfirmationData> or <Condition>, right ?

Right, those are for acceptance of the assertion before a local session is created.

> Furthermore, it has nothing to do with the IDP local session time-out 
> period, right ?

Right. Though the IDP can put a maximum lifetime on the SP session by including a SessionNotOnOrAfter as part of the AuthnStatement, IIRC.

These are all SAML questions (except the first one) so be sure to verify that with the spec. Maybe E26 of the approved errata helps:
http://docs.oasis-open.org/security/saml/v2.0/sstc-saml-approved-errata-2.0.html
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net